Resource assignment

You can assign resources, create project routing rules for Active Directory and Okta Universal Directory accounts, and modify SaaS app settings.

Before you begin

Ensure that you have the Okta Privileged Access resource admin role.

Assign Okta Universal Directory accounts to projects

  1. On the Okta Privileged Access dashboard, go to Resource Administration > Resource assignment.

  2. Select the Okta Universal Directory tab.

  3. Click Assign account on the app instance you want to assign to a resource group.

  4. On the dialog that appears, select a Resource group and Project.

  5. Optional. Rotate passwords upon assignment is enabled by default. Click the checkbox to disable it.

  6. Click Assign.

You can view the assigned account in resource groups.

Set up Active Directory account rule settings.

See Configure individual account rule settings.

Change rotation strategy for SaaS apps

Use the password rotation strategy with custom SCIM connectors to support rotating passwords for accounts in on-premise apps that require the account's current password to perform a rotation.

  1. On the Okta Privileged Access dashboard, go to Resource Administration > Resource assignment.

  2. Select SaaS Apps tab.

  3. Click the Actions menu, and then click Change rotation strategy. With the standard setting, only the new password is sent to the SCIM connector. If the concatenated setting is enabled, both current and new passwords are sent together in the following format: "<length of current password>;<current password><new password>". Custom SCIM connectors must unpack the concatenated passwords to perform password rotation in the downstream app.

  4. On the dialog that appears, select Standard or Concatenated.

  5. Click Continue.

Set credential for a service account

You can manually set the credential for Active Directory, SaaS, and Okta Universal Directory service accounts when migrating from a legacy PAM vault, recovering a lost credential, or applying a one-off override. When you set a credential, Okta Privileged Access stores it immediately without triggering automatic rotation or sync. You then control when and whether to push the credential to the target system, enabling a phased cutover on your own timeline.

If the account is currently checked out by another user, you'll see an error message. You must force check-in the account first before you can set a new credential. See Force a checkin.

  1. Go to Resource Administration > Resource management.

  2. Select Active Directory, SaaS apps, or Okta Universal Directory as the Resource Type.

  3. Select the account for which you want to set the credential.

  4. Click the Actions menu, and then click Set credential.

  5. In the dialog that appears, enter the credential in the Credential field.

  6. Click Save.

After setting the credential, the account's rotation schedule continues unchanged. You control when to sync the credential to the target system. For SaaS accounts, use Workflows or SCIM. For Active Directory accounts, use the Okta Universal Directory API or your directory sync process.